Add shared Hugo deployment workflows

.forgejo/workflows/publish-image.yml

@@ -0,0 +1,75 @@
+name: Publish Hugo Deployment Image
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+    inputs:
+      image_tag:
+        description: Image tag to publish
+        required: false
+        type: string
+      publish_latest:
+        description: Also update latest
+        required: false
+        type: boolean
+        default: false
+
+concurrency:
+  group: publish-image-${{ forgejo.repository }}
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    runs-on: docker-desktop
+    env:
+      EVENT_NAME: ${{ forgejo.event_name }}
+      REGISTRY_HOST: ${{ vars.REGISTRY_HOST }}
+      REGISTRY_USERNAME: ${{ vars.REGISTRY_USERNAME }}
+      IMAGE_REPO: cliper/hugo-deployment
+      IMAGE_TAG: ${{ inputs.image_tag != '' && inputs.image_tag || forgejo.sha }}
+      PUBLISH_LATEST: ${{ inputs.publish_latest }}
+    steps:
+      - name: Checkout repository
+        uses: https://data.forgejo.org/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+
+      - name: Validate registry configuration
+        env:
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+        run: |
+          set -euo pipefail
+          test -n "${REGISTRY_HOST:-}" || { echo "Missing REGISTRY_HOST" >&2; exit 1; }
+          test -n "${REGISTRY_USERNAME:-}" || { echo "Missing REGISTRY_USERNAME" >&2; exit 1; }
+          test -n "${REGISTRY_PASSWORD:-}" || { echo "Missing REGISTRY_PASSWORD" >&2; exit 1; }
+
+      - name: Validate image tag
+        run: |
+          set -euo pipefail
+          printf '%s' "$IMAGE_TAG" | grep -Eq '^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$' || {
+            echo "Invalid IMAGE_TAG: $IMAGE_TAG" >&2
+            exit 1
+          }
+
+      - name: Log in to registry
+        env:
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+        run: |
+          set -euo pipefail
+          printf '%s' "$REGISTRY_PASSWORD" | docker login "$REGISTRY_HOST" -u "$REGISTRY_USERNAME" --password-stdin
+
+      - name: Build image
+        run: |
+          set -euo pipefail
+          docker build \
+            -t "${REGISTRY_HOST}/${IMAGE_REPO}:${IMAGE_TAG}" \
+            -t "${REGISTRY_HOST}/${IMAGE_REPO}:latest" \
+            .
+
+      - name: Push image tags
+        run: |
+          set -euo pipefail
+          docker push "${REGISTRY_HOST}/${IMAGE_REPO}:${IMAGE_TAG}"
+          if [ "${EVENT_NAME:-}" = "push" ] || [ "${PUBLISH_LATEST:-false}" = "true" ]; then
+            docker push "${REGISTRY_HOST}/${IMAGE_REPO}:latest"
+          fi